T10.6 - record what was built in wave-10.md

docs/waves/wave-10.md

@@ -61,6 +61,24 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other
   config they never ended up describing (D13 never shipped, so these still describe the
   original local-password system today).
 
+  Built: all three rewritten — the five `OKTA_*` vars documented the same way
+  `AUTH_SECRET_KEY` already was, the login-portal/self-service-reset sections replaced
+  with the Okta flow and the promote-not-create admin bootstrap (D16), the smoke-test
+  walkthrough updated for `WP_SMOKE_USER`-only / must-share-`AUTH_SECRET_KEY`-and-DB
+  (T10.4's `smoketest.py` rewrite). Also `docker-compose.yml`, not originally named in
+  this bullet: its `api` service sets `environment:` as an explicit allowlist, not
+  `env_file`, so the documented vars would silently never reach the container without
+  adding them there too — found and fixed in the same commit rather than shipping docs
+  for a config path that doesn't work. `OKTA_IDENTITY_CLAIM` mirrors
+  `okta_auth.py`'s own default (`preferred_username`) in the compose file rather than
+  defaulting to an empty string, which would 503 every sign-in.
+
+  Logged, not fixed here (out of scope): `users.failed_attempts`/`locked_until` are
+  vestigial (still reset on every Okta sign-in, nothing increments them since local
+  `login()` is gone); `server/README.md`'s own "Production — Docker Compose" section
+  is a self-contained alternate quickstart that already diverged from the real root
+  `docker-compose.yml` before this task and still does.
+
 - **T10.7 — Test coverage without a live Okta dependency.** A fake-OIDC-provider test
   seam, mirroring `ldap_fake.py`, so the suite runs with no live Okta tenant reachable.
   Built: `server/okta_fake.py` (env-driven, `WP_OKTA_FAKE_DIRECTORY`, production-refusing